Digital Account Ownership: Who Owns Your Accounts?

Digital account ownership is something many businesses never question until they need to change agencies, replace a developer or recover access to an important service.

Your website might be running perfectly. Google Ads might be generating enquiries. Your business could appear in Google Maps, with analytics recording every visitor. From the outside, everything belongs to your business.

But who actually controls the accounts behind it all?

If an agency registered your domain, created your Google accounts and set up your website using its own systems, you might discover that paying for those services hasn’t given you the level of control you expected.

The sensible starting point is that your business should retain control of its essential digital accounts, while agencies and other suppliers receive the access they need to do their work. That doesn’t mean every service must be billed directly to you or that every website component automatically becomes your intellectual property. It means the responsibilities, permissions and rights should be clear before they become a problem.

Digital Account Ownership Is More Than Having a Password

One of the biggest misunderstandings surrounding digital account ownership is that being able to log in means you own the account or the underlying assets.

There are actually three separate questions to consider.

1. Who is the registered account holder?

This is the person or organisation recorded as the customer, registrant or account holder by the relevant provider.

For example, a domain name has a registrant associated with its registration. According to ICANN’s guidance for domain registrants, the registrant has contractual rights and responsibilities relating to the domain.

If your domain is registered through an agency’s account, you need to establish who the actual registrant is. The person paying the invoice is not necessarily the person recorded in the registration.

2. Who has administrative control?

Administrative control determines who can manage users, change settings, configure services or potentially remove another person’s access.

You might have access to Google Analytics reports without being able to administer the Analytics account. Similarly, having a WordPress administrator login doesn’t automatically give you control of the hosting account, domain registration or server infrastructure.

Access to a service and control over the service are not always equivalent.

3. Who has the legal rights to the work?

This is particularly important for websites, branding, software and other creative assets.

Under UK copyright guidance, commissioning work from an independent creator doesn’t automatically transfer copyright to the person paying for it. The UK Intellectual Property Office explains that the creator is generally the first copyright owner of commissioned work unless different arrangements are agreed in writing.

That means a business could have full administrator access to a website but still need to check its contract before assuming it owns the underlying design, code, photographs or other protected material.

Licences for themes, plugins, fonts, stock images and third-party software can also impose separate restrictions.

Good digital account ownership therefore involves more than collecting usernames. It requires understanding account registration, technical control and contractual rights.

Which Digital Accounts Should Your Business Control?

Not every platform uses the word “owner” in the same way. Some distinguish between administrators and managers, while others separate account access from billing or registration rights.

The following table provides a practical starting point for reviewing digital account ownership across the systems many businesses depend on.

These are recommended arrangements rather than universal legal ownership rules. The appropriate setup can vary according to the platform, service contract and type of project.

Why Domain Name Ownership Deserves Particular Attention

Your domain name is more than your website address. It can also be connected to your business email, verification records and services that depend on DNS configuration.

Imagine changing web developers and discovering that your previous supplier is the only person able to update the domain’s nameservers.

Even if you have a complete backup of the website, moving it to a new hosting provider could become unnecessarily difficult.

The first step is identifying your registrar and checking who is recorded as the registrant. You should also know who controls the renewal settings, DNS records and registration contact details.

Can an agency prevent you from transferring your domain?

Domain transfer rights depend on the registration and the policies governing that particular domain extension.

For many generic top-level domains, ICANN’s domain transfer guidance describes circumstances where transfers may be restricted, including certain 60-day lock periods.

However, UK domains have their own registry rules. Nominet’s .uk policies provide for registrants to move between registrars and have different transfer-lock arrangements from generic domains governed by ICANN’s transfer policy.

The important point is not to assume every domain follows the same process.

If your business uses a .uk, .co.uk, .com or another extension, establish the relevant transfer requirements before changing suppliers, particularly when the domain supports active business email.

Who Owns Your Google Ads Account When an Agency Runs It?

Google Ads is a useful example of why account ownership and account management shouldn’t be confused.

Agencies commonly use Google Ads manager accounts to work across several clients. This is a normal platform-supported arrangement and doesn’t automatically mean the agency owns the client’s advertising data.

Google’s documentation on manager account ownership explains that even when a manager has administrative ownership, the individual client account retains ownership of its data and can remove the manager’s access by unlinking, subject to the relevant access requirements.

The problem arises when a business has no independent administrative access to its own advertiser account or doesn’t understand how billing and management are configured.

Before entering an agency relationship, establish:

• Whether the advertising runs through a dedicated Google Ads account for your business.
• Whether your business has direct administrator access to that account.
• Which manager accounts are linked and what authority they have.
• Who controls billing and the associated payments profile.
• What happens to the existing account, campaigns and conversion tracking if you change agencies.

Google confirms that unlinking an individual client account from a manager doesn’t remove the account’s campaign history.

That distinction matters. Changing your advertising supplier shouldn’t automatically mean abandoning the existing advertiser account and starting measurement from scratch.

Billing still needs separate attention, particularly where an agency acts as the paying manager. Google provides specific procedures for transferring client accounts between agencies when payment arrangements change.

Digital account ownership should be agreed before advertising begins, not investigated after a disagreement about campaign performance or fees.

Google Business Profile: Being a Manager Isn’t the Same as Being the Owner

For a local business, Google Business Profile can be one of its most important customer-facing accounts.

The profile may contain business information, opening hours, photographs, reviews and contact details.

Google distinguishes between owners and managers. Owners can manage access to the profile, while managers have more limited permissions.

Crucially, a Business Profile has one primary owner.

According to Google’s official primary ownership transfer guidance, only the current primary owner can transfer that role. Google also imposes a seven-day restriction on certain actions for newly added owners and managers.

If an agency originally created your listing, check which account currently holds primary ownership.

There is nothing inherently wrong with an agency maintaining your Google Business Profile. The concern is whether your business could still administer the profile independently if that working relationship ended.

Google Analytics and Search Console Have Different Ownership Rules

Two more accounts deserve attention because they’re frequently established during website development or SEO setup.

Google Analytics

Google Analytics uses account-level and property-level permissions. A user can have access to a specific property without administering the wider Analytics account.

Google’s Analytics user-management documentation explains how administrator permissions govern account and property access.

If a property needs moving between Analytics accounts, Google supports that process, but the person performing it needs the required permissions in both accounts. Its GA4 property transfer guidance also explains which data and settings move with the property and which remain behind.

For businesses, the preferred arrangement is generally to keep the Analytics environment under appropriate organisational administration and delegate access to the agency handling reporting.

Google Search Console

Search Console distinguishes between verified owners, delegated owners and other users.

Verified ownership proves control over a website through an accepted verification method, such as a DNS record or verification file.

There is an additional issue here: removing somebody from the user list may not be enough if their ownership verification token still exists.

Google’s Search Console permission guidance explains that a former verified owner may be able to verify ownership again if the relevant token remains in place.

When taking over a website, checking Search Console permissions should therefore include checking the verification methods and unused ownership tokens, not just removing unfamiliar email addresses.

What About the Website Itself?

Website ownership is often more complicated than ownership of a Google account.

A website can involve several independently managed components:

• The domain registration and DNS.
• The hosting subscription and server environment.
• The website files, database and uploaded content.
• Custom code, design assets and written content.
• Third-party plugins, software licences and integrations.
• Backups, credentials and maintenance arrangements.

Being able to edit pages through WordPress does not necessarily mean you can download a complete website backup or migrate to another hosting provider.

Equally, having access to the hosting account doesn’t automatically establish ownership of every copyrighted element used on the site.

Before commissioning a website, contracts should explain what work is being delivered, what rights are assigned or licensed, which third-party components are included, and what the customer can take away if the service ends.

This becomes especially important when a business wants to move from a managed website service to another developer.

The same planning matters for ongoing work. As we discuss in our article on WordPress security updates, keeping a business website maintained requires continuing technical responsibility. Someone should have the access needed to maintain and secure the system without leaving the business dependent on one unavailable individual.

How to Carry Out a Digital Account Ownership Audit

You don’t need to change agencies to establish whether your business controls its digital infrastructure.

A straightforward digital account ownership audit can identify where access is secure, where responsibilities are unclear and where you might encounter difficulties later.

Step 1: List every important account

Create an inventory covering your domain, hosting, website, business email, Google services, social media, advertising platforms, CRM and other essential systems.

For each one, record the provider, relevant account identifier, responsible organisation, administrators, billing arrangement and renewal date.

Keep this inventory somewhere secure. Don’t use an ordinary shared spreadsheet to store account passwords or recovery codes.

Step 2: Check your actual permissions

Don’t rely entirely on being told you have access.

Sign in using an account controlled by your business and check your permission level. Can you manage other users? Can you control the service settings? Can you recover access if another administrator becomes unavailable?

If the answer isn’t clear, ask the platform administrator to explain the account structure.

Step 3: Identify single-person dependencies

Look for systems where only one individual can perform an essential action.

This might be a former employee, freelance developer or agency administrator.

Google specifically recommends having multiple administrators for Tag Manager and says account management should remain with someone inside the organisation rather than being dependent on an external agency. See its Tag Manager access guidance.

Where a platform supports it, use named accounts, appropriate additional administrators and multifactor authentication rather than sharing a single login.

Step 4: Review contracts and transfer arrangements

Check who holds the rights to the work, whether data can be exported, who owns third-party subscriptions and what assistance is provided when the relationship ends.

Pay particular attention to any limitations affecting source code, creative assets, backups, platform licences and account transfers.

Step 5: Establish a safe handover procedure

If you discover that an essential account is controlled externally, don’t immediately remove users or change critical settings.

First establish the necessary access, recoverability, backup arrangements and any contractual requirements.

Then plan a controlled handover. Confirm that the receiving administrator can access and manage the account before removing the previous supplier’s permissions.

This is especially important for DNS, email, advertising billing and website hosting, where an uncoordinated change can interrupt live business services.

What Should You Ask an Agency Before It Creates Your Accounts?

A good time to resolve digital account ownership is before the first account is created.

These questions can be included in a website development, marketing or business-launch discussion:

• Whose account will this be created under? Will the business be the registered customer or primary administrator, where applicable?
• What level of access will we receive? Can the business manage permissions independently?
• Who handles billing and renewals? Which subscriptions are managed by the supplier and which are held directly?
• What happens if we change supplier? Can accounts, data and deliverables be transferred without unnecessarily rebuilding the setup?
• What do we legally own? Which website, branding or software rights are assigned to the business, and which remain licensed?
• How is access protected? Are individual accounts, appropriate permissions and secure recovery methods used?

These aren’t unreasonable questions or signs of distrust. They are ordinary parts of managing technology that a business depends on.

An agency may have good reasons to centralise hosting, billing or technical management. The important thing is that the customer understands and agrees to the arrangement.

Why Digital Account Ownership Should Be Considered During a Business Launch

When a new business launches, there are numerous connected systems to establish. The domain, website, email, search presence, analytics and advertising setup all need to work together.

That’s one reason account responsibility should be addressed at the beginning rather than treated as an administrative detail after launch.

Nort Labs’ NL Launch business launch service brings together branding, website development, business email, Google setup, search foundations and an initial Google Ads campaign as part of a coordinated digital launch.

The importance of the underlying infrastructure is also explained in our guide to setting up a business’s digital foundations.

For any coordinated launch, including one managed by Nort, the sensible questions remain the same: which organisation holds each account, who can administer it, who handles renewals and billing, and what happens if the management arrangement changes?

Those responsibilities should be established in the agreed scope and account setup, rather than assumed simply because one team is coordinating the project.

The Real Test: Could Your Business Change Suppliers Without Losing Control?

Digital account ownership isn’t about making agencies unnecessary. Businesses often benefit from experienced specialists managing systems they don’t have the time or knowledge to maintain themselves.

The real question is whether that expertise comes with unnecessary dependency.

If you changed developers tomorrow, could you access your website and its backups? If you appointed a different advertising agency, could it work with your existing Google Ads account? If your marketing manager left, would your organisation still control Analytics, Search Console and Tag Manager?

If the answers are uncertain, it’s worth addressing the gaps while everything is working.

A well-managed digital setup should make it straightforward for the right people to do their jobs without leaving the business unable to control its own essential accounts.

That’s a practical standard worth agreeing with any supplier before the work begins.